CVE-2026-88774

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName =~ "httpd" or InitiatingProcessFileName =~ "nginx"
| where RemoteUrl contains "..%2f" or RemoteUrl contains "%2e%2e%2f" or RemoteUrl contains "/etc/passwd" or RemoteUrl contains "/proc/self/cmdline"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

Splunk SPL

(sourcetype=access_combined OR sourcetype=nginx:access) (uri_path="%2e%2e%2f" OR uri_path="..%2f" OR uri_path="/etc/passwd" OR uri_path="/proc/self/cmdline")
| table _time, host, uri_path, clientip

Sigma

title: Citrix NetScaler Feature Policy Bypass Attempt
status: experimental
description: Detects attempts to bypass feature policies in Citrix NetScaler ADC/Gateway via HTTP URL-based expressions.
logsource:
  category: webserver
  service: access_log
detection:
  selection:
    cve_2026_88774_indicators:
      - url|contains: ['..%2f', '%2e%2e%2f', '/etc/passwd', '/proc/self/cmdline']
  condition: selection
fields:
  - client_ip
  - url
  - user_agent
level: medium

Elastic ES|QL

FROM logs-webserver-*-* 
| WHERE url.path : ("*%2e%2e%2f*", "*..%2f*", "*/etc/passwd*", "*/proc/self/cmdline*")
| SELECT @timestamp, host.name, url.original, source.ip